Author Topic: Help decoding mail server logs  (Read 1406 times)

SoreTween

  • Most of me survived the Pennine Bridleway.
Help decoding mail server logs
« on: 28 October, 2017, 11:35:36 am »
Whenever an event organiser sends out ride info I don't get the email, my mail server appears to be bouncing it.  This only happens for the bulk send to all riders, the same email resent just to me gets through fine.   Can anyone see what might be wrong from these log entries?

Code: [Select]
26 17:38:37[1593] Received 212.159.9.81 blacksheepaudax@gmail.com <[mydomain]postie> 2229034 <CAKYAuCLV=cgYvV7HBsDKCR_92PryaaVoRECSuMJctSgfhVF38g@mail.gmail.com> "Relay=islocal, nrcpt=1, s=[Mr. Pickwick's Crych Cymraeg .]"
26 17:38:38[1593] Aspam 212.159.9.81 blacksheepaudax@gmail.com <[mydomain]postie@[mydomain].co.uk> 2229034 <CAKYAuCLV=cgYvV7HBsDKCR_92PryaaVoRECSuMJctSgfhVF38g@mail.gmail.com> "notrust *****************: 17.6 sd=17.6  1.00(X-PhraseHits:scam) 1.00(X-PhraseHits:prize) 0.70(X-To-Not-Matched:true) [nnot=0,ng=0,nsum=2,nb=2,nw=0,13.62]"
26 17:38:38.40 [1593] Spam 212.159.9.81 blacksheepaudax@gmail.com <[mydomain]postie@[mydomain].co.uk> 2229034 <CAKYAuCLV=cgYvV7HBsDKCR_92PryaaVoRECSuMJctSgfhVF38g@mail.gmail.com> "[localhost] SpamDetect"
26 17:38:38.84 [1593] Failed 212.159.9.81 blacksheepaudax@gmail.com <[mydomain]postie@[mydomain].co.uk> 2229034 <CAKYAuCLV=cgYvV7HBsDKCR_92PryaaVoRECSuMJctSgfhVF38g@mail.gmail.com> "[localhost] Bounced Exceptions Score exceeded or bounce set to always 8 >= 17 (*****************: 17.6 sd=17.6  1.00(X-PhraseHits:scam) 1.00(X-PhraseHits:prize) 0.70(X-To-Not-Matched:true) [nnot=0,ng=0,nsum=2,nb=2,nw=0,13.62])"

The mail server is Surgemail.  It has about a gazillion settings and is galactic scale overkill for my one man company + 2 personal domains but inertia keeps me using it.  None of the settings in the aspam pages jump out at me as relevant searching for Bounce or Exception.

Thanks
2023 targets: Survive. Maybe.
There is only one infinite resource in this universe; human stupidity.

vorsprung

  • Opposites Attract
    • Audaxing
Re: Help decoding mail server logs
« Reply #1 on: 28 October, 2017, 11:44:11 am »
I would guess that the email from an organiser is addressed to a list of people

That's probably the difference in those types of emails

Then the highly complex rules of your email server do the wrong thing

This is why I use Gmail for everything, it's easier than running your own email server

iddu

  • Are we there yet?
Re: Help decoding mail server logs
« Reply #2 on: 29 October, 2017, 01:03:10 am »
::
::
 None of the settings in the aspam pages jump out at me as relevant searching for Bounce or Exception.

From the help guides:-

"g_spam_bounce - Bounce local delivery based on spamdetect score

If spamdetect score (number of '*'s) is above this, bounce message if local delivery. 14 is a reasonable value, never set below 10.

Syntax: g_spam_bounce int
"

I'd guess it's detecting 17 things it doesn't like in the multi-recipient mails vide "...Bounced Exceptions Score exceeded or bounce set to always 8 >= 17 (*****************:...", so you need to look at/get it to tell you what sub-content it's thinking is 'spam' trigger value.

Quick test: set your end to stupidly high value and ask Mark to send a null group mail...
I'd offer you some moral support - but I have questionable morals.

SoreTween

  • Most of me survived the Pennine Bridleway.
Re: Help decoding mail server logs
« Reply #3 on: 29 October, 2017, 02:08:08 am »
From the help guides:-

"g_spam_bounce - Bounce local delivery based on spamdetect score

If spamdetect score (number of '*'s) is above this, bounce message if local delivery. 14 is a reasonable value, never set below 10.

Syntax: g_spam_bounce int
"

Thanks Iddu.  I found the setting with wording most similar to that (not the same) under a section titled Should probably not be used and set it to 20.  The .ini file now contains g_spam_bounce "20".  I'll see what that does to my spam rate for a week.

I'd guess it's detecting 17 things it doesn't like in the multi-recipient mails vide "...Bounced Exceptions Score exceeded or bounce set to always 8 >= 17 (*****************:...", so you need to look at/get it to tell you what sub-content it's thinking is 'spam' trigger value.

629 page manual in which the settings don't match on screen =  :'( bed time reading.  But still better than gmail.
2023 targets: Survive. Maybe.
There is only one infinite resource in this universe; human stupidity.

Afasoas

Re: Help decoding mail server logs
« Reply #4 on: 02 November, 2017, 11:23:44 am »
You should be able to whitelist certain mail servers and email addresses/domains.

I used realtime block lists (necessary evil since hosting my F-i-Ls email) and as yahoo, aol and even Google keep getting mailservers onto RBLs I've had to whitelist a few.

http://linuxlasse.net/linux/howtos/Blacklist_and_Whitelist_with_Postfix